<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01411189</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-23T06:09:31+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">SFMap: Inferring Services over Encrypted Web Flows Using Dynamical Domain Name Graphs</title>
            <author role="aut">
              <persName>
                <forename type="first">Tatsuya</forename>
                <surname>Mori</surname>
              </persName>
              <email type="md5">f861f18d935d038281fd7cf62444d169</email>
              <email type="domain">nsl.cs.waseda.ac.jp</email>
              <idno type="idhal" notation="numeric">995519</idno>
              <idno type="halauthorid" notation="string">1090333-995519</idno>
              <affiliation ref="#struct-168249"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Takeru</forename>
                <surname>Inoue</surname>
              </persName>
              <idno type="halauthorid">1090334-0</idno>
              <affiliation ref="#struct-301586"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Akihiro</forename>
                <surname>Shimoda</surname>
              </persName>
              <idno type="halauthorid">1090335-0</idno>
              <affiliation ref="#struct-301586"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Kazumichi</forename>
                <surname>Sato</surname>
              </persName>
              <idno type="halauthorid">1090336-0</idno>
              <affiliation ref="#struct-301586"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Keisuke</forename>
                <surname>Ishibashi</surname>
              </persName>
              <idno type="halauthorid">599174-0</idno>
              <affiliation ref="#struct-301586"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Shigeki</forename>
                <surname>Goto</surname>
              </persName>
              <idno type="halauthorid">1090337-0</idno>
              <affiliation ref="#struct-168249"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2016-12-07 10:54:27</date>
              <date type="whenModified">2023-02-17 15:30:06</date>
              <date type="whenReleased">2016-12-07 11:00:28</date>
              <date type="whenProduced">2015-04-21</date>
              <date type="whenEndEmbargoed">2018-01-01</date>
              <ref type="file" target="https://hal.science/hal-01411189v1/document">
                <date notBefore="2018-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-01411189v1/file/336978_1_En_9_Chapter.pdf" id="file-1411189-1497004">
                <date notBefore="2018-01-01"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01411189</idno>
            <idno type="halUri">https://hal.science/hal-01411189</idno>
            <idno type="halBibtex">mori:hal-01411189</idno>
            <idno type="halRefHtml">&lt;i&gt;7th Workshop on Traffic Monitoring and Analysis (TMA)&lt;/i&gt;, Apr 2015, Barcelona, Spain. pp.126-139, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-319-17172-2_9"&gt;&amp;#x27E8;10.1007/978-3-319-17172-2_9&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">7th Workshop on Traffic Monitoring and Analysis (TMA), Apr 2015, Barcelona, Spain. pp.126-139, &amp;#x27E8;10.1007/978-3-319-17172-2_9&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-1411189-1497004"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP-LNCS" corresp="IFIP">IFIP - Lecture Notes in Computer Science</idno>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC6" corresp="IFIP-TC">TC 6: Communication Systems</idno>
            <idno type="stamp" n="IFIP-TMA">IFIP-TMA</idno>
            <idno type="stamp" n="IFIP-WG6-6">Management of Networks and Distributed Systems</idno>
            <idno type="stamp" n="IFIP-LNCS-9053" corresp="IFIP-LNCS">Traffic Monitoring and Analysis</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 3: Web</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">SFMap: Inferring Services over Encrypted Web Flows Using Dynamical Domain Name Graphs</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Tatsuya</forename>
                    <surname>Mori</surname>
                  </persName>
                  <email type="md5">f861f18d935d038281fd7cf62444d169</email>
                  <email type="domain">nsl.cs.waseda.ac.jp</email>
                  <idno type="idhal" notation="numeric">995519</idno>
                  <idno type="halauthorid" notation="string">1090333-995519</idno>
                  <affiliation ref="#struct-168249"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Takeru</forename>
                    <surname>Inoue</surname>
                  </persName>
                  <idno type="halauthorid">1090334-0</idno>
                  <affiliation ref="#struct-301586"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Akihiro</forename>
                    <surname>Shimoda</surname>
                  </persName>
                  <idno type="halauthorid">1090335-0</idno>
                  <affiliation ref="#struct-301586"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Kazumichi</forename>
                    <surname>Sato</surname>
                  </persName>
                  <idno type="halauthorid">1090336-0</idno>
                  <affiliation ref="#struct-301586"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Keisuke</forename>
                    <surname>Ishibashi</surname>
                  </persName>
                  <idno type="halauthorid">599174-0</idno>
                  <affiliation ref="#struct-301586"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Shigeki</forename>
                    <surname>Goto</surname>
                  </persName>
                  <idno type="halauthorid">1090337-0</idno>
                  <affiliation ref="#struct-168249"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">Lecture Notes in Computer Science</title>
                <meeting>
                  <title>7th Workshop on Traffic Monitoring and Analysis (TMA)</title>
                  <date type="start">2015-04-21</date>
                  <date type="end">2015-04-24</date>
                  <settlement>Barcelona</settlement>
                  <country key="ES">Spain</country>
                </meeting>
                <editor>Moritz Steiner</editor>
                <editor>Pere Barlet-Ros</editor>
                <editor>Olivier Bonaventure</editor>
                <imprint>
                  <biblScope unit="serie">Traffic Monitoring and Analysis</biblScope>
                  <biblScope unit="volume">LNCS-9053</biblScope>
                  <biblScope unit="pp">126-139</biblScope>
                  <date type="datePub">2015</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-319-17172-2_9</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halDomain" n="info.info-ni">Computer Science [cs]/Networking and Internet Architecture [cs.NI]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Most modern Internet services are carried over the web. A significant amount of web transactions is now encrypted and the transition to encryption has made it difficult for network operators to understand traffic mix. The goal of this study is to enable network operators to infer hostnames within HTTPS traffic because hostname information is useful to understand the breakdown of encrypted web traffic. The proposed approach correlates HTTPS flows and DNS queries/responses. Although this approach may appear trivial, recent deployment and implementation of DNS ecosystems have made it a challenging research problem; i.e., canonical name tricks used by CDNs, the dynamic and diverse nature of DNS TTL settings, and incomplete measurements due to the existence of various caching mechanisms. To tackle these challenges, we introduce domain name graph (DNG), which is a formal expression that characterizes the highly dynamic and diverse nature of DNS mechanisms. Furthermore, we have developed a framework called Service-Flow map (SFMap) that works on top of the DNG. SFMap statistically estimates the hostname of an HTTPS server, given a pair of client and server IP addresses. We evaluate the performance of SFMap through extensive analysis using real packet traces collected from two locations with different scales. We demonstrate that SFMap establishes good estimation accuracies and outperforms a state-of-the-art approach.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 6</org>
              <org type="consortium">WG 6.6</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-168249" status="VALID">
          <idno type="ISNI">0000 0001 2158 5974</idno>
          <orgName>Waseda University [Tokyo]</orgName>
          <desc>
            <address>
              <addrLine>1-104 Totsukamachi, Shinjuku-ku, Tokyo, 169-8050</addrLine>
              <country key="JP"/>
            </address>
            <ref type="url">https://www.waseda.jp/top/en</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-301586" status="VALID">
          <orgName>NTT Corporation</orgName>
          <desc>
            <address>
              <country key="JP"/>
            </address>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>